Researcher Breaks Claude Code Opus 5 Auto Mode 80% of the Time
Security researcher Johann Rehberger has demonstrated an attack against Anthropic's Claude Code auto mode that succeeds roughly 80% of the time, exploiting a zip archive to execute malicious code the safety classifier fails to block.
Update (9 Nov 2026): Claude Fable 5.2 and Mythos 5.2 are out - prices, access and benchmarks are in my Claude Fable 5.2 guide.
👁 117 reads
A security researcher has demonstrated a significant vulnerability in Anthropic’s Claude Code auto mode, successfully bypassing its safety features in approximately 80% of attempts. The attack, published by Johann Rehberger on 27th August 2026, raises important questions about the security of AI coding agents that operate with reduced human oversight.
- Johann Rehberger found a prompt-injection attack that defeats Claude Code auto mode in about 80% of attempts
- The attack tricks the agent into downloading and uncompressing a zip archive, causing it to import and execute a hidden malicious file
- In some runs, auto mode blocked Claude's own attempt to terminate the malware process it had allowed to start
How the Attack Works Against Claude Code
The technique exploits a weakness in how Claude Code’s auto mode classifier evaluates potentially dangerous actions. Rehberger’s attack tricks Claude Code into downloading and uncompressing a zip archive, then executing code that imports base64. The critical vulnerability lies in what happens next: the model fails to recognize that this seemingly innocent action will also import and run a local file called struct.py that was extracted from the same archive.
This is a form of what security experts call a “confused deputy” attack, where a trusted system is manipulated into performing actions it shouldn’t. In this case, Claude Code doesn’t understand that importing one module will trigger the execution of malicious code hidden in another file. The auto mode classifier, which is designed to determine when actions are safe enough to proceed without asking the user for permission, allowed the malware process to start.
The Safety System Made Things Worse
Perhaps most concerning is what happened after the malicious code began running. In several recorded runs, Claude Code actually detected that something was wrong and attempted to terminate the compromised process. However, the auto mode classifier then blocked the agent’s own cleanup command. This means the safety mechanism designed to protect users actually protected the malware instead, preventing Claude from stopping the attack it had inadvertently enabled.
This ironic failure highlights a fundamental challenge in building autonomous AI systems: safety mechanisms need to understand context, not just individual actions. A system that can approve dangerous actions but then block legitimate cleanup attempts is worse than having no automation at all.
What This Means for AI Coding Tool Users
Auto mode in Claude Code was recently made the default setting by Anthropic, meaning the system makes more decisions without asking for user confirmation. While this improves the user experience by reducing interruptions, this research demonstrates that the technology may not be ready for fully unattended operation in security-sensitive environments.
Simon Willison, commenting on Rehberger’s findings, endorsed several practical mitigations that anyone using coding agents should consider implementing. These include running unattended coding agents inside a container, virtual machine, or operating system sandbox to limit potential damage. Users should also restrict network egress so compromised agents cannot easily communicate with external servers, monitor agent activity for suspicious behavior, and keep sensitive data like home directories, SSH keys, and cloud credentials completely separate from the agent runtime environment.
These precautions treat AI coding agents as potentially untrustworthy, which may seem extreme but reflects the current reality: these systems can be manipulated into taking harmful actions even when safety features are enabled.
Google · Your sourcesQuantslant higher in your Google - one clickAdd to preferred sources →Frequently Asked Questions
What is Claude Code auto mode?
Auto mode is a feature in Anthropic’s Claude Code that allows the AI coding agent to make decisions and take actions without constantly asking the user for permission. Anthropic recently made this the default setting, but this research shows the safety classifier that determines which actions are safe can be fooled roughly 80% of the time.
Who discovered this vulnerability?
Security researcher Johann Rehberger published the attack on 27th August 2026. His research demonstrated that Claude Code could be tricked into downloading, extracting, and running malicious code hidden in a zip archive without the auto mode classifier recognizing the danger.
How can users protect themselves when using AI coding agents?
According to recommendations endorsed by Simon Willison, users should run coding agents inside containers, virtual machines, or sandboxes, restrict network access, monitor agent activity, and keep sensitive files like SSH keys and cloud credentials completely separate from where the agent operates.
More on this from QUANTSLANT
news·Anthropic Paper Shows AI System Outperforms Humans at Alignment